What is MiStorage?

Renter accounts are scoped per location: the same person legitimately holds separate accounts at two locations, so the unique key is CustomerId + Email, not Email alone.

It was built as a multi-tenant SaaS platform selling subscriptions to storage companies. Since 2026-09-10 that is not the product: the client is the storage operator. They own the units, nobody bills them, and rent settles to their own merchant. The SaaS layer is archived rather than deleted — it still compiles and is still covered by tests, but every one of its endpoints answers 404 while the flag is off.

Middleware order in Program.cs: security headers → global exception handler → rate limiting → HSTS / HTTPS redirect (production) → CORS → authentication → SaaS feature gate → authorization → controllers. Request bodies are capped at 10 MB. GET /api/health is mapped outside the controllers: anonymous, unthrottled, and not wrapped in the response envelope.

• CORS allows the configured frontend origins with credentials.
• Rate limiting is per IP, in buckets grouped by surface so one audience can never exhaust another's allowance. Refresh is unmetered on purpose — it is cookie-authenticated and runs on a timer.
• The SaaS gate runs before authorization, so an archived endpoint answers 404 to everyone rather than 401 or 400, which would advertise that it exists.
• Authorization uses three policies keyed off a userType claim stamped at mint time: SystemUser, TenantUser and Renter. Each audience has its own refresh-token table, so a token minted for one can never be presented against another.

Refresh tokens are hashed at rest and rotated on every use. A rotated token presented again outside a short grace window is treated as theft and revokes the whole family. See the APIs page for the session policy and the full endpoint reference.

What a rental application asks for (Social Security Number, driver's licence) is resolved by ApplicationFieldPolicyService from three levels — the unit, then its location, then the installation default. null means "no opinion, ask the level above"; false means "do not ask". Both fields are collected by default.

• Manage Facility on an HQ location page signs the administrator into that location's console as its Owner and lands on /tenant/{id}/dashboard. The button is disabled unless the location is active. The exchange is audited (Location.Entered, naming the HQ user); after that the session is an ordinary Owner session.
• Back to HQ appears in the console's user menu while the HQ session is still live in that tab. It disappears after a hard reload; the HQ URL still works.
• The Staff tab on a location page lists its logins — role, status, last seen, created — and lets HQ add a Manager or Staff login, set a password, or deactivate and reactivate one. Every location has one Owner, seeded when the location is created; the Owner can be given a new password but not deactivated.
• Setting a password or deactivating a login signs that person out everywhere. There are no invitations or emailed resets yet, because email does not deliver.
• Manager and Staff see the whole location console today: tenant RBAC is not built.

Guided tour. Both consoles open with a step-by-step tour the first time each user signs in on a browser: 27 steps for HQ (dashboard, locations, Manage Facility, staff, users and roles, protection plans, notifications, tasks, settings) and 21 for a location (dashboard, units, renters, leases, notifications, settings). It moves between pages by itself, works from the keyboard (← →, Esc to skip), and falls back to a centred card when a target is hidden, as on a phone. Progress lives in the browser's localStorage (mistorage.tutorial.{hq|location}.{userId}); the Start the tutorial card under Settings replays it.

Renter applications. Staff can open a renter's rental application from the Renters page (click the name, or View Application): contact details, driver's licence, emergency and alternate contacts, employer, how they heard about the location, texting consent and account status. The Social Security Number is never sent to the browser — only whether one is on file.

• The storefront is server-rendered and the rest of the app is not. A shop window has to be indexable and fast on a phone.
• `/s/{subdomain}` instead of real subdomains. A stand-in until DNS automation (Phase 6); routing already keys off the subdomain segment.
• Move-out is notice, not cancellation. A renter gives notice; the lease stays active and rent keeps accruing until staff end it.
• Registration returns one identical acknowledgement for every outcome when email verification is on. That is an anti-enumeration measure, not a missing branch.
• Signing in does not end a renter's other sessions. POST /api/renter-auth/revoke-all is the deliberate way to end all of them.
• The API does not migrate on startup. Production schema changes are applied by hand from an audited, idempotent script.